9.2 Pocket Notebooks, Occurrence Books and Incident Reports

9.2 Pocket Notebooks, Occurrence Books and Incident Reports

In the private security profession, an unwritten operational axiom holds true across all disciplines: "If it is not recorded, it never happened." A security guard may perform flawless patrol duties, de-escalate volatile confrontations, or discover critical structural hazards; however, if those events are not formally documented in an approved, contemporaneous, and legally compliant manner, their operational and legal value is entirely lost. In Abu Dhabi, security records may be requested by the police and the Public Prosecution during investigations. Company records can also be inspected by the licensing authority at any time (Article 19 of Federal Law No. 37 of 2006). This section examines the legal status and strict maintenance rules of the Security Pocket Notebook, the operational role of the Daily Occurrence Book (DOB), and the objective construction of formal Incident Reports.

---

The Legal Status of Contemporaneous Documentation

A contemporaneous document is a record created at the exact time an event occurs, or as soon as practically possible afterward while the details remain completely fresh in the officer's memory. Records made at the time carry far more weight with investigators, prosecutors and courts than recollections assembled later. That applies under both the Criminal Procedure Law (Federal Decree-Law No. 38 of 2022) and the Law of Evidence in Civil and Commercial Transactions (Federal Decree-Law No. 35 of 2022).

[Incident occurs] --> notes written at once --> accurate, detailed record
        |
        v
[Days or months later] --> memory has faded --> the notebook shows what was seen at the time

When a security officer is called to testify before an Abu Dhabi criminal court or civil tribunal regarding an assault, commercial burglary, or fatal industrial accident that took place six months prior, the officer cannot be expected to recall precise timestamps, vehicle license numbers, or exact verbal exchanges from memory alone. A notebook that was written at the time, with no sign of later alteration, is what allows the guard to give an accurate account and shows that the record can be trusted.

---

The Security Pocket Notebook and the "No ELBOWS" Rule

The pocket notebook is part of every guard's working equipment. Article 104 of Ministerial Decision No. 557 lists "a notebook to write down notes" and "two pens at least" among the accessories a guard's uniform must carry, and NSI awards 10% of the Basic Security Guard assessment for notebook maintenance. Notebooks are usually issued by the company with numbered pages and remain company property. Completed notebooks are handed in and kept under the company's records policy, never thrown away.

A memory aid widely taught by police and security trainers for keeping a notebook trustworthy is "No ELBOWS":

Good Notebook Practice

1. Permanent ink: use black or blue ballpoint, never pencil or erasable ink.
2. Correct errors openly: draw one straight line through the mistake so it stays readable, write the correction next to it and initial it. Example: Incident occurred at 14:15 [struck through] 14:25 hrs. [Initials: TR]
3. Start every entry properly: day, date, time (24-hour clock) and location, for example Thursday, 02 October 2026, 14:35 hrs, Musaffah Base Camp.
4. Record exact words: put what people said in quotation marks, including slang or insults. Direct speech is more reliable than a summary.
5. Write at the time: make the entry during the event or as soon as possible afterwards, while details are fresh.
6. Close off: rule off unused space at the end of each entry and sign at the end of the shift.

---

The Daily Occurrence Book (DOB / Daily Log)

While the pocket notebook travels with the individual officer, the Daily Occurrence Book (DOB) is a permanently bound station ledger that remains permanently assigned to a static post, gatehouse, or control room. It constitutes the uninterrupted, official historical log of all operational events occurring on that site over a 24-hour cycle.

┌─────────────────────────────────────────────────────────────────────────────┐
│                     MANDATORY OCCURRENCE BOOK ENTRIES                       │
├─────────────────────────────────────────────────────────────────────────────┤
│ 1. Shift Commencement: Date, shift type, names & PSBD IDs of all guards     │
│ 2. Equipment Inventory: Radios, flashlights, search mirrors, gate systems   │
│ 3. Key Transactions: Master key issue/return logged against Key Register    │
│ 4. Perimeter Patrol Deployments: Start time, route taken, anomalies, return │
│ 5. System Alarms: Fire alarm panel, intruder detection, elevator emergency │
│ 6. Access Control Activity: Heavy delivery arrivals, after-hours contractors│
│ 7. Official Visits: Client managers, police patrol visits, PSBD inspectors  │
│ 8. Shift Handover: Joint audit confirmation, open issues, dual sign-off     │
└─────────────────────────────────────────────────────────────────────────────┘

Legal and Operational Rules Governing the DOB:

• Permanently Bound Format: Loose-leaf binders, spiral notebooks, or digital text files that can be edited without an audit log are not permitted as official station DOBs under standard PSBD site regulations. The book must be bound with pre-printed page numbers.
• Unbroken Chronological Sequence: Entries must follow chronological order. No officer may backdate an entry or jump ahead to leave space for a colleague.
• Accountability Sign-Off: Every discrete entry must conclude with the recording officer's signature, printed full legal name, and their official PSBD License Number.

---

Incident Report Writing: The "5 Ws and H"

When a significant security, safety, or criminal event occurs—such as a burglary, physical assault, vehicular collision, water pipe rupture, or fire alarm activation—a notebook entry or DOB log is insufficient on its own. The security officer must draft a formal Security Incident Report.

A formal incident report is an executive document submitted to senior security management, the client organization, insurance loss adjusters, and frequently the Abu Dhabi Police. To ensure total thoroughness, every incident report must be structured around the foundational 5 Ws and H framework.

                      ┌────────────────────────────────────┐
                      │     The 5 Ws and H Framework       │
                      └─────────────────┬──────────────────┘
                                        │
     ┌──────────────┬─────────────┬─────┴──────┬─────────────┬──────────────┐
     ▼              ▼             ▼            ▼             ▼              ▼
┌──────────┐   ┌──────────┐  ┌──────────┐ ┌──────────┐  ┌──────────┐   ┌──────────┐
│   WHO    │   │   WHAT   │  │  WHERE   │ │   WHEN   │  │   WHY    │   │   HOW    │
│ Persons  │   │ Specific │  │ Precise  │ │ Exact 24h│  │ Known    │   │ Sequence │
│ involved │   │ incident │  │ location │ │ timestamp│  │ root     │   │ of events│
│ & witness│   │ nature   │  │ & room   │ │ & date   │  │ causes   │   │ unfolded │
└──────────┘   └──────────┘  └──────────┘ └──────────┘  └──────────┘   └──────────┘

Breaking Down the 5 Ws and H:

1. WHO: Identify all individuals connected to the incident. Record full legal names (as shown on Emirates IDs or passports), contact telephone numbers, employer or tenant unit, and their specific role (victim, reporting party, witness, suspect, security officer, responding police officer).
2. WHAT: State precisely what occurred. Use clear, factual legal descriptions (e.g., theft of electrical cable, vehicular collision with boom barrier, slip and fall on wet tile). Avoid ambiguous headings like "trouble at loading bay".
3. WHERE: Detail the exact geographical and architectural location. Never write simply "at the building". Specify: Abu Dhabi Financial Centre, Tower 2, Basement Level 1, Parking Bay 114 adjacent to Fire Exit Stairwell C.
4. WHEN: Document the exact timeline using the 24-hour format: when the incident occurred, when security detected or was notified of it, when emergency services were summoned, when police arrived, and when the scene was cleared.
5. WHY: Detail the observable root causes or conditions that contributed to the incident (e.g., heavy rain caused floor tiles to become slippery, contractor failed to latch the security fire door). Critical Rule: Never speculate or guess about motive. If the motive is unknown, state: "Motive undetermined at time of report."
6. HOW: Provide a chronological narrative detailing how the incident developed from start to finish, step-by-step, including all actions taken by security personnel to contain the hazard, render first aid, preserve evidence, and restore normal operations.

---

Objective Fact vs. Subjective Opinion / Speculation

The single most critical standard in professional report writing is maintaining absolute objectivity. An incident report must be a pristine record of verifiable sensory facts—what the officer physically saw, heard, smelled, touched, or measured. It must never contain personal opinions, emotional reactions, moral judgments, or unverified assumptions.

               ┌─────────────────────────────────────────────────┐
               │    Objective Fact vs. Subjective Speculation    │
               └────────────────────────┬────────────────────────┘
                                        │
         ┌──────────────────────────────┴──────────────────────────────┐
         ▼                                                             ▼
┌─────────────────────────────────┐           ┌─────────────────────────────────┐
│      Objective Fact (VALID)     │           │   Subjective Opinion (INVALID)  │
│ • Observable sensory evidence   │           │ • Personal assumptions          │
│ • Measurable data (time, distance)│         │ • Emotional labels              │
│ • Direct verbatim quotes        │           │ • Speculation about guilt/motive│
│ • Supported by CCTV or photos   │           │ • Unproven medical diagnoses    │
└─────────────────────────────────┘           └─────────────────────────────────┘

---

Structure of a Professional Security Incident Report

Every comprehensive incident report should follow a standardized five-part structure to ensure clarity, logical flow, and professional presentation:

┌─────────────────────────────────────────────────────────────────────────────┐
│                  STANDARD 5-PART INCIDENT REPORT TEMPLATE                   │
├─────────────────────────────────────────────────────────────────────────────┤
│ Part 1: Administrative Header ──► Reference ID, Date, Time, Location, Guard│
│ Part 2: Executive Summary ─────► 2-3 sentence overview of the core event   │
│ Part 3: Chronological Narrative► Step-by-step account using timestamps      │
│ Part 4: Actions Taken ─────────► First aid, emergency calls (999), cordons  │
│ Part 5: Evidence & Attachments ─► CCTV camera IDs, photo logs, witness lists│
└─────────────────────────────────────────────────────────────────────────────┘

1. Administrative Header: Form number, incident classification, exact date and time, facility name, post location, and author details (full name, rank, PSBD license number).
2. Executive Summary: A concise, high-level summary that answers: what happened, where, when, and the overall outcome, allowing senior executives to grasp the situation in seconds.
3. Chronological Narrative: The detailed body of the report, organized sequentially by timestamp (e.g., 14:10 hrs... 14:15 hrs... 14:22 hrs...). Each paragraph describes a distinct action or observation.
4. Action Taken: Specific emergency actions initiated: emergency services contacted (including call dispatch reference numbers), medical triage provided, fire extinguishers discharged, building utilities isolated, or cordons established.
5. Evidence and Attachments: Documentation of physical evidence secured: CCTV cameras covering the zone (e.g., Camera CAM-B1-04 archived), photographs taken, damage cost estimates, signed witness statements, and police officer details.

---

Practical UAE Operational Scenario

The Incident

Security Officer Fatima is on patrol on the ground floor retail concourse of a luxury shopping mall on Yas Island, Abu Dhabi. At 16:30, a store manager from a designer boutique runs out shouting for security. Fatima responds immediately and observes a store employee physically detaining an individual in the corridor. A broken display case glass shelf is visible inside the boutique, and two high-value watches lie on the floor.

[16:30 Concourse Patrol] ──► Shouting Observed at Boutique ──► Staff Detaining Subject
                                        │
                                        ▼
                            Officer Fatima's Actions:
  • Separates parties safely, de-escalating physical contact
  • Observes physical facts: Broken display glass, 2 watches on floor
  • Checks for injuries: Store employee has minor scratch on right forearm
  • Logs contemporaneous pocket notebook entries following the No ELBOWS rules
  • Requests Control Room to contact Abu Dhabi Police (999) and secure CCTV
                                        │
                                        ▼
Documentation Executed:
1. Notebook: Exact quotes from manager ("He smashed the glass"), 24-hr timestamps
2. DOB: Station log updated with police arrival (Car 214, Sgt. Al Mansoori)
3. Incident Report: 5 Ws and H, objective sensory data, zero speculation on intent

Applied Actions and Documentation

1. Immediate On-Scene Action: Fatima de-escalates the physical struggle, ensures no further harm occurs, and checks the employee's scratched forearm. She requests the mall Control Room to dial 999 for Abu Dhabi Police and export footage from concourse camera CAM-GF-12.
2. Pocket Notebook Notes: Fatima pulls out her official notebook. Under today's date (Thursday, 02 Oct 2026), she records: 16:32 hrs: Responded to Boutique 14. Observed store clerk Ahmed Al Zaabi (EID 784-1990-1234567-1) holding the jacket sleeve of a male who identified himself as John Doe. Observed 2 luxury watches on floor tiles. Observed glass shelf inside boutique broken. She notes verbatim speech: Mr. Al Zaabi stated: "I saw him take the watches from the shelf and run." Subject stated: "I didn't steal anything, I tripped into the shelf."
3. Applying No ELBOWS: When Fatima mistakenly writes 16:40 instead of 16:32, she draws a single neat line through 16:40, writes 16:32, and initials it [FA]. She leaves no blank lines, drawing a diagonal line at the end of the entry.
4. Formal Incident Report: Later that evening, Fatima types the official Incident Report for mall management and Abu Dhabi Police CID. She avoids subjective commentary like "the thief brazenly robbed the shop", replacing it with factual descriptions: "Suspect was detained outside Boutique 14 with two store watches on the ground adjacent to him." The case proceeds smoothly to Public Prosecution because the documentation is tamper-proof, objective, and contemporaneous.

---

Section Summary Review Checklist for the PSBD Exam

• Contemporaneous: Notes written at the time of the event refresh memory in court and carry high evidentiary weight.
• No ELBOWS: no Erasures, no Leaves torn out, no Blank spaces, no Overwriting, no Writing between lines, no Spare pages. Correct errors with a single strike-through and initials, and record speech in quotation marks.
• DOB Ledger: Bound, tamper-evident station log recording continuous 24-hour site history; signed with PSBD license numbers.
• 5 Ws and H: Who, What, When, Where, Why, How; forms the essential skeleton of every formal incident report.
• Objectivity: Report solely observable sensory facts (what was seen, heard, smelled); never include assumptions, emotional labels, or unproven guilt.